Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-30932Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

High 8.6

In plain English

A high-severity injection in froxlor from froxlor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	froxlor/froxlor	2.3.5	GHSA-x6w6-2xwp-3jh6

Affected products (as reported)

Vendor	Product	Versions
froxlor	froxlor	< 2.3.5

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/froxlor/froxlor/security/advisories/GHSA-x6w6-2xwp-3jh6 x_refsource_CONFIRM
https://github.com/froxlor/froxlor/commit/b34829262dc32818b37f6a1eabb426d0b277a86b x_refsource_MISC
https://github.com/froxlor/froxlor/releases/tag/2.3.5 x_refsource_MISC